d03265d96d07dabca21327a9295899cd6e8009a6f2da2e0dc7848d2fbf0982d3

General

Target

468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
Size

356KB
MD5

468e8b371933c19752e927b2a9d09546
SHA1

e904bf6466c3562531e0a148f8b72c3d732b63e7
SHA256

d03265d96d07dabca21327a9295899cd6e8009a6f2da2e0dc7848d2fbf0982d3
SHA512

246bd2aceb0f5bdcd6265304ccf75f936711cff5aeb8ea21d91e6e22dc5f4db0d9b0242978684216983a2a304f5c6747eeed676f5900412f4130e3639404ab83
SSDEEP

3072:gEXroutKmHkgFh782f/Bh6mUMDc0whM27TWob3ae6naElN:gYroSKd2NqfPysdjQN

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2552	b2e.exe

Loads dropped DLL 2 IoCs

pid	Process
1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-0-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1956-13-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\win.ini	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2552	1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2552	1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2552	1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2552	1956	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2104	2552	b2e.exe	31
PID 2552 wrote to memory of 2104	2552	b2e.exe	31
PID 2552 wrote to memory of 2104	2552	b2e.exe	31
PID 2552 wrote to memory of 2104	2552	b2e.exe	31
PID 2104 wrote to memory of 2468	2104	cmd.exe	33
PID 2104 wrote to memory of 2468	2104	cmd.exe	33
PID 2104 wrote to memory of 2468	2104	cmd.exe	33
PID 2104 wrote to memory of 2468	2104	cmd.exe	33
PID 2104 wrote to memory of 1812	2104	cmd.exe	34
PID 2104 wrote to memory of 1812	2104	cmd.exe	34
PID 2104 wrote to memory of 1812	2104	cmd.exe	34
PID 2104 wrote to memory of 1812	2104	cmd.exe	34
PID 2104 wrote to memory of 2332	2104	cmd.exe	35
PID 2104 wrote to memory of 2332	2104	cmd.exe	35
PID 2104 wrote to memory of 2332	2104	cmd.exe	35
PID 2104 wrote to memory of 2332	2104	cmd.exe	35
PID 2104 wrote to memory of 2316	2104	cmd.exe	36
PID 2104 wrote to memory of 2316	2104	cmd.exe	36
PID 2104 wrote to memory of 2316	2104	cmd.exe	36
PID 2104 wrote to memory of 2316	2104	cmd.exe	36

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2332	attrib.exe
2316	attrib.exe
2468	attrib.exe
1812	attrib.exe

C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\91F3.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\91F3.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\91F3.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\929F.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\autoexec.bat
      4⤵
      Views/modifies file attributes
      PID:2468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\boot.ini
      4⤵
      Views/modifies file attributes
      PID:1812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\ntldr
      4⤵
      Views/modifies file attributes
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\windows\win.ini
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\929F.tmp\batchfile.bat

Filesize
856B

MD5
64b23eb863f42552ba617b9b41aef88c

SHA1
bdb311c81fe60fc51409d75588a6f5206f18aa0a

SHA256
d2d5c13c364aeb5fadce9a5c954f81630b867ed802364876ac2f8ebc22d8f018

SHA512
afe0cb0545bc79e1ff1f2856b09302ccad6ec0a74f0a3aefdb566eb0442060ebf6a74d7a9c51018453a9ab2b7e9613455267ffcc243aae6e3253920d8a57dd45

Download Submit
\Users\Admin\AppData\Local\Temp\91F3.tmp\b2e.exe

Filesize
10KB

MD5
eb7ac023e0d91083b2b19c50398f21a8

SHA1
98d4bc67d0d97ac12ef0c985d2f8bc2bdda6f816

SHA256
5c53dda02f5769338a498f47629428b0e4a8ace839e4a6317638743179f842bb

SHA512
7f93207c81eee978cd9e845f656f733d00e3a78acd22c12710ae9cdcee7197fa6736e9a7c7e0411481cdc75519e35aa26cd7dbe4aa185885c068370e27c0362e

Download Submit
memory/1956-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1956-5-0x0000000000330000-0x0000000000335000-memory.dmp

Filesize
20KB

Download
memory/1956-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2552-16-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing